diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2017-06-08 14:14:40 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2017-06-08 14:14:45 +0200 |
| commit | a43e61842ec55baa486d60eed2a19af67ba78b9f (patch) | |
| tree | 6c3c93f19e3933273b73b9edd16edc146ab18527 /drivers/char/mem.c | |
| parent | 5d473fedd17ae3a9f92fb35551e307d01459ea6a (diff) | |
| parent | 50dffe7fad6c156c2928e45c19ff7b86eb951f4c (diff) | |
| download | linux-a43e61842ec55baa486d60eed2a19af67ba78b9f.tar.bz2 | |
Merge remote-tracking branch 'net-next/master' into mac80211-next
This brings in commit 7a7c0a6438b8 ("mac80211: fix TX aggregation
start/stop callback race") to allow the follow-up cleanup.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'drivers/char/mem.c')
| -rw-r--r-- | drivers/char/mem.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/char/mem.c b/drivers/char/mem.c index 7e4a9d1296bb..6e0cbe092220 100644 --- a/drivers/char/mem.c +++ b/drivers/char/mem.c @@ -340,6 +340,11 @@ static const struct vm_operations_struct mmap_mem_ops = { static int mmap_mem(struct file *file, struct vm_area_struct *vma) { size_t size = vma->vm_end - vma->vm_start; + phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT; + + /* It's illegal to wrap around the end of the physical address space. */ + if (offset + (phys_addr_t)size < offset) + return -EINVAL; if (!valid_mmap_phys_addr_range(vma->vm_pgoff, size)) return -EINVAL; |